Analysis
-
max time kernel
125s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
23/02/2024, 11:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Built.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Built.exe
Resource
win10v2004-20240221-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
Built.exe
-
Size
259KB
-
MD5
ca4b8fc345cfaf06f3cd8cda56d0079c
-
SHA1
d331e1cad391d476a7ac14317f3a87cea7c8077a
-
SHA256
c1f255c61cf56fe58f5e05af953310da9d1c1dbca626c40fc6a25e8431a1abf9
-
SHA512
b026eec51464ec0d608b4bb29772f854ab74afa982ccf284cf1a0fc8495e911a743fa7db04a7debc078a3b6b3c8f33dedada59343d43a3317de0a7733b0df4d9
-
SSDEEP
3072:gTvsIMl0W5yfppxfipSKfw04xUlTbLB8xtN3zViGSnkhGeTE2Or0WQuGH5Pk8lFr:gkUpXKAKEgTbLBu73zikhwGWG9Oir
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1392040655-2056082574-619088944-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 5032 taskmgr.exe Token: SeSystemProfilePrivilege 5032 taskmgr.exe Token: SeCreateGlobalPrivilege 5032 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe 5032 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Built.exe"C:\Users\Admin\AppData\Local\Temp\Built.exe"1⤵PID:1896
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5032
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5040
-
C:\Windows\System32\xamcbp.exe"C:\Windows\System32\xamcbp.exe"1⤵PID:956
-
C:\Windows\System32\xamcbp.exe"C:\Windows\System32\xamcbp.exe"1⤵PID:4624